Diagnostic AI that lives where your records live.
A diagnostic layer built for your health system: the best frontier models, tested and tuned on your own cases, running in your own cloud tenant under your own BAA. We handle everything in between.
- 1 in 4
- inpatients who died or went to the ICU had a diagnostic error
- Auerbach, JAMA IM 2024
- 7.2%
- of general-medicine inpatients suffer a harmful diagnostic error
- Dalal, BMJ Qual Saf 2025
- 2.4×
- the mortality when the discharge diagnosis differs from admission
- Hautz, SJTREM 2019
- 0
- records that leave your environment
- by design
Your clinicians already use frontier models. The open questions are whether the one reading an inpatient record has been tested on your patients, and where the record goes while it reads. This answers both.
A frontier model is the start. The layer around it is the work.
Model A
current
Model B
candidate · fails your set
Open weights
on your hardware
Scored on your graded cases
01The model, chosen by evidence
Frontier models from OpenAI, Anthropic and Google, or open weights on your own hardware, reached through the cloud tenant you already hold. A new model ships only after it beats the current one on your cases.
Every calcium in the record
5 draws · 3 sourcesDate Ca Phos Source Oct 14 06:10 10.8 2.4 day 1 labs Oct 15 05:50 10.7 2.5 day 2 labs Oct 16 06:05 10.9 2.3 day 3 labs Mar 2025 10.6 2.6 prior stay, p. 2 Aug 2024 10.8 — outside PCP, p. 7 PTH: never measured. Each cell points to a page.
02The harness
How the record is read. Every page, this stay and the ones before it. Every value of one kind in one table. Every explanation in the chart checked against what happened next. Every line cited back to a page.
- clinician agreesmissed by the chart, caughtflag not usefulnot yet graded
~300 of your own cases, graded by your clinicians
03Your own cases
Your clinicians grade a few hundred of your own cases. The layer is calibrated on them, and its accuracy is reported on them, not on a public benchmark. The graded set is yours and stays yours.
Flags raised, flags acted on
one unit · 6 weeksWk 1Wk 2Wk 3Wk 4Wk 5Wk 6Model swap proposed · Wk 5held: 2 misses on your set04Monitoring that does not stop
Every flag acted on or dismissed is logged. Drift is watched. A weekly report goes to your quality lead. When a model is swapped, the swap is tested on your set first.
What the chart supports but never named.
A synthetic inpatient, written for this page. Day three of a pneumonia admission; the finding is in the labs of this stay and two before it.
Calcium 10.7 to 10.9 on all three draws this admission, and 10.6 to 10.8 on two prior ones back to 2024. Phosphorus low each time. PTH has never been measured.
Fits primary hyperparathyroidism. The prior-stay discharge summary attributes the calcium to dehydration; it was still high at the outpatient draw ten days later.
- Urine output not charted since 02:00; creatinine up 0.4 from admission. Flowsheet · I&O
- Home apixaban held on admission; no restart note. Med rec · p. 1
One line, and what sits on each side of it.
The whole arrangement fits on one page, and it goes into the agreement in these words.
- Your records
- Stay in your tenant. They are never copied to us or to a lab, and never pooled with another system's.
- The model
- Called inside your tenant through Azure, AWS or Google Cloud under the BAA you already hold, or run as open weights on your hardware.
- Your graded cases and calibration
- Yours. If we part ways, you keep them and we return or destroy everything else, with a certificate.
- The pipeline
- Ours. It runs inside your environment. Nothing it learns about your patients leaves with it.
- The decision
- Your clinicians'. The layer hands them a differential with citations for review. It does not order, chart, page or alert.
You bring the records and the clinicians. We do the rest.
- 01Weeks 1 to 3
Connect
Read access to the record through the interfaces your EHR already exposes, set up inside your tenant with your security team. Nothing is written back.
- 02Weeks 3 to 8
Grade
Your clinicians grade a few hundred of your own recent cases against the layer's output. We fit the calibration on them and report the accuracy, good or bad.
- 03Weeks 8 to 10
Deploy
One unit or service first. Flags go to a reviewing clinician, not to the bedside. We sit in on the first weeks of review.
- 04Ongoing
Keep it honest
Weekly report, drift checks, model swaps tested on your set before they ship. The number we report is measured on your patients.
Weeks are a plan, not a promise. Your security review sets the pace of the first step.
The first few health systems, as partners.
We are taking on a small number of design partners. Each gets the layer in its own tenant, a number measured on its own patients, and a say in what it catches first.
The layer, in your tenant
Harness, retrieval and calibration running where your records already live.
A number measured on your patients
Accuracy on your graded cases, reported to you, including what it missed.
A say in what it catches first
Design partners choose the first unit and the first patterns.
Terms fixed before anything is connected
Design-partner pricing agreed up front, a strict BAA, and ownership of your graded set.
A champion
A CMIO, chief AI officer or quality lead who wants this measured on their own patients.
Read access, under your BAA
Inside your tenant, set up with your security team, nothing written back.
Clinician hours to grade cases
A few hours a week for about five weeks. We pay for the time if you prefer.
Candour
Tell us what was not useful. The layer is tuned by what your clinicians dismiss as much as by what they act on.
What CMIOs ask us
Our clinicians already have a frontier model through our EHR or a chat tool. Why this?
Those give each clinician a model to ask. This gives your system a layer that reads every inpatient record on its own, with its accuracy measured on your patients, the model chosen and swapped by evidence, and the record never leaving your tenant. It runs alongside what you have.
Do you train a model on our data?
No model is trained on your identifiable records and taken anywhere. The calibration is fitted on cases your clinicians graded, and it stays yours. If a narrow tuned component ever helps, it is trained on open weights, inside your tenant, and belongs to you.
Which EHRs?
Any that exposes the standard read interfaces. The first partners decide the order. We set up read access with your security team; we do not write to the chart.
Is it a medical device?
It is built as a differential with citations for clinician review, which the FDA's clinical decision support guidance treats as non-device. It does not analyze images or signals, does not alert at the bedside, and never speaks to a patient. We keep it that way.
Who sees our records?
Your tenant does. Our engineers reach it only under your BAA, through access you grant and log. We keep nothing identifiable outside your environment.
What does it cost?
Design-partner terms are agreed before anything is connected, and fixed for the partnership. We tell you the number in the first conversation.
Tell us about your system.
We reply within one business day with the one-page arrangement and a time to talk. The first call is thirty minutes, with the people who would build it.
Prefer email? hello@thousandhealth.com
The patient, unit and findings shown on this page are synthetic, written to show how it works. Lab and cloud names are the vendors a health system may already use; none is a partner or endorser. Thousand Health reads records and reports what is in them; every clinical decision stays with the treating clinician.